Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,494)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-29145 1Ericsson 2Bscs Ix R18 Billing & Rating Admx Bscs Ix R18 Billing & Rating Mx Jun 17, 2026 Nov 27, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 In Ericsson BSCS iX R18 Billing & Rating iX R18, ADMX is a web base module in BSCS iX that is vulnerable to stored XSS via the name or description field to a solutionUnitServlet?SuName=UserReferenceDataSU Access Rights G...Show more In Ericsson BSCS iX R18 Billing & Rating iX R18, ADMX is a web base module in BSCS iX that is vulnerable to stored XSS via the name or description field to a solutionUnitServlet?SuName=UserReferenceDataSU Access Rights Group. In most test cases, session hijacking was also possible by utilizing the XSS vulnerability. This potentially allows for full account takeover, or exploiting admins' browsers by using the beef framework.Show less
CVE-2020-29144 1Ericsson 2Bscs Ix R18 Billing & Rating Admx Bscs Ix R18 Billing & Rating Mx Jun 17, 2026 Nov 27, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 In Ericsson BSCS iX R18 Billing & Rating iX R18, MX is a web base module in BSCS iX that is vulnerable to stored XSS via an Alert Dashboard comment. In most test cases, session hijacking was also possible by utilizing th...Show more In Ericsson BSCS iX R18 Billing & Rating iX R18, MX is a web base module in BSCS iX that is vulnerable to stored XSS via an Alert Dashboard comment. In most test cases, session hijacking was also possible by utilizing the XSS vulnerability. This potentially allows for full account takeover, or exploiting admins' browsers by using the beef framework.Show less
CVE-2020-29137 1Cpanel 1Cpanel Jun 17, 2026 Nov 27, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577).
CVE-2020-29133 1Coremail Xt Project 1Coremail Xt Jun 17, 2026 Nov 27, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 jsp/upload.jsp in Coremail XT 5.0 allows XSS via an uploaded personal signature, as demonstrated by a .jpg.html filename in the signImgFile parameter.
CVE-2020-12262 1Intelbras 3Tip200 Firmware Tip200lite FirmwareTip300 Firmware Jun 17, 2026 Nov 27, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Intelbras TIP200 60.61.75.15, TIP200LITE 60.61.75.15, and TIP300 65.61.75.15 devices allow /cgi-bin/cgiServer.exx?page= XSS.
CVE-2020-29070 1Oscommerce 1Oscommerce Jun 17, 2026 Nov 25, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 osCommerce 2.3.4.1 has XSS vulnerability via the authenticated user entering the XSS payload into the title section of newsletters.
CVE-2020-29071 1Liquidfiles 1Liquidfiles Jun 17, 2026 Nov 25, 2020 N/A· v4 9.0 CRITICAL· v3 8.5 HIGH· v2 An XSS issue was found in the Shares feature of LiquidFiles before 3.3.19. The issue arises from the insecure rendering of HTML files uploaded to the platform as attachments, when the -htmlview URL is directly accessed....Show more An XSS issue was found in the Shares feature of LiquidFiles before 3.3.19. The issue arises from the insecure rendering of HTML files uploaded to the platform as attachments, when the -htmlview URL is directly accessed. The impact ranges from executing commands as root on the server to retrieving sensitive information about encrypted e-mails, depending on the permissions of the target user.Show less
CVE-2020-29053 1Hrsale 1Hrsale Jun 17, 2026 Nov 24, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 HRSALE 2.0.0 allows XSS via the admin/project/projects_calendar set_date parameter.
CVE-2020-25474 1Newsscriptphp 1News Script Php Pro Jun 17, 2026 Nov 24, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 SimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Scripting (XSS) vulnerability via the editor_name parameter.
CVE-2020-29003 1Mediawiki 1Mediawiki Jun 17, 2026 Nov 24, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The PollNY extension for MediaWiki through 1.35 allows XSS via an answer option for a poll question, entered during Special:CreatePoll or Special:UpdatePoll.
CVE-2020-29002 1Mediawiki 1Mediawiki Jun 17, 2026 Nov 24, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 includes/CologneBlueTemplate.php in the CologneBlue skin for MediaWiki through 1.35 allows XSS via a qbfind message supplied by an administrator.
CVE-2020-26227 1Typo3 1Typo3 Jun 17, 2026 Nov 23, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 the system extension Fluid (typo3/cms-fluid) of the TYPO3 core is vulnerable to cross-site scripting passing us...Show more TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 the system extension Fluid (typo3/cms-fluid) of the TYPO3 core is vulnerable to cross-site scripting passing user-controlled data as argument to Fluid view helpers. Update to TYPO3 versions 9.5.23 or 10.4.10 that fix the problem described.Show less
CVE-2020-28927 1Magicpin 1Magicpin Jun 17, 2026 Nov 23, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 There is a Stored XSS in Magicpin v2.1 in the User Registration section. Each time an admin visits the manage user section from the admin panel, the XSS triggers and the attacker can able to steal the cookie according to...Show more There is a Stored XSS in Magicpin v2.1 in the User Registration section. Each time an admin visits the manage user section from the admin panel, the XSS triggers and the attacker can able to steal the cookie according to the crafted payload.Show less
CVE-2020-15249 1Octobercms 1October Jun 17, 2026 Nov 23, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.469, backend users with access to upload files were permitted to upl...Show more October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.469, backend users with access to upload files were permitted to upload SVG files without any sanitization applied to the uploaded files. Since SVG files support being parsed as HTML by browsers, this means that they could theoretically upload Javascript that would be executed on a path under the website's domain (i.e. /storage/app/media/evil.svg), but they would have to convince their target to visit that location directly in the target's browser as the backend does not display SVGs inline anywhere, SVGs are only displayed as image resources in the backend and are thus unable to be executed. Issue has been patched in Build 469 (v1.0.469) & v1.1.0.Show less
CVE-2020-26239 1Scratchaddons 1Scratch Addons Jun 17, 2026 Nov 23, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Scratch Addons is a WebExtension that supports both Chrome and Firefox. Scratch Addons before version 1.3.2 is vulnerable to DOM-based XSS. If the victim visited a specific website, the More Links addon of the Scratch Ad...Show more Scratch Addons is a WebExtension that supports both Chrome and Firefox. Scratch Addons before version 1.3.2 is vulnerable to DOM-based XSS. If the victim visited a specific website, the More Links addon of the Scratch Addons extension used incorrect regular expression which caused the HTML-escaped values to be unescaped, leading to XSS. Scratch Addons version 1.3.2 fixes the bug. The extension will be automatically updated by the browser. More Links addon can be disabled via the option of the extension.Show less
CVE-2020-7571 1Schneider Electric 1Webreports Jun 17, 2026 Nov 19, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A CWE-79 Multiple Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Reflected) vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause a remote attac...Show more A CWE-79 Multiple Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Reflected) vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause a remote attacker to inject arbitrary web script or HTML due to incorrect sanitization of user supplied data and achieve a Cross-Site Scripting reflected attack against other WebReport users.Show less
CVE-2020-7570 1Schneider Electric 1Webreports Jun 17, 2026 Nov 19, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Stored) vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote us...Show more A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Stored) vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Cross-Site Scripting stored attack against other WebReport users.Show less
CVE-2020-28350 1Sokrates 1Sowasql Jun 17, 2026 Nov 19, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Cross Site Scripting (XSS) vulnerability exists in OPAC in Sokrates SOWA SowaSQL through 5.6.1 via the sowacgi.php typ parameter.
CVE-2020-28210 1Schneider Electric 1Ecostruxure Building Operation Jun 17, 2026 Nov 19, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability exists in EcoStruxure Building Operation WebStation V2.0 - V3.1 that could cause an attacker to inject HTML and Ja...Show more A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability exists in EcoStruxure Building Operation WebStation V2.0 - V3.1 that could cause an attacker to inject HTML and JavaScript code into the user's browser.Show less
CVE-2020-28947 2Misp Misp Project 2Misp Misp Jun 22, 2026 Nov 19, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In MISP 2.4.134, XSS exists in the template element index view because the id parameter is mishandled.

Previous 1...169216931694...2425 Next